Three flaws a language-model scan dug up are the first disclosed under Core’s new rules for bugs that are easy to find